          wrap-params
          wrap-schema-validation)
 
+     ;; TODO Implement RFC 6749 4.1.2.1 Error Response
+
      ::permit
      (->
       ;; TODO I'm worred about the fact we must ensure that the session


  WebService
  (request-handlers [this]
    {::authorize
     (-> (fn [req]
           ;; TODO Establish whether the user-agent is already authenticated.
           ;; If not, create a session with client-id, scope and state and redirect to the login form

         wrap-params )})

  (routes [this]
    ["/" {"authorize" {:get ::authorization-endpoint}
          "permit-client" {:post ::permit}
          ;; TODO: Can we use a hyphen instead here?
          "access_token" {:post ::token-endpoint}}])

  (uri-context [this] "/login/oauth")

  AccessTokenAuthorizer
  (authorized? [component access-token scope]
    (if-not (contains? (set (keys scopes)) scope)
      (throw (ex-info "Scope is not a known scope to this authorization server"
                      {:component component
                       :scope scope
                       :scopes scopes}))
      (contains? (:scopes (get-session (:access-token-store component) access-token))
                 scope)))

  RequestAuthorizer
